The Adversarial Robustness Toolbox (ART) version 1.20.1 (and earlier) contains a flaw in its Kubeflow component that uses the built‑in eval() function to interpret user‑supplied strings as code for LossFn and Optimizer parameters without any sanitization. An attacker who can supply a crafted string will cause eval() to execute arbitrary Python code during model evaluation, resulting in remote code execution and full compromise of the host system running ART.

The vulnerability affects installations of ART through version 1.20.1 that include the Kubeflow component. Environments that integrate ART 1.20.1 or earlier and expose the Kubeflow interface for loss or optimizer configuration are at risk.

The CVSS score of 9.8 marks this as critical and the EPSS score of < 1% indicates a low but non‑zero probability of exploitation. Because eval() lacks any protective controls, an attacker who can provide a malicious string—such as through a configured Kubeflow endpoint—can hijack the service and achieve total compromise without needing further privileges. The flaw is not listed in CISA’s KEV catalog, yet its high severity and the ease of exploitation make it a high‑risk vulnerability that should be remediated immediately.